Intruders disabled alarms and altered pumping cycles at two small Colorado water utilities

Changing an equipment setting, switching off an alarm and altering a pumping cycle are operator actions ^[6]. They need access to the control system. Few technical details have been released, and the public account does not say how the intruders got that access ^[5]. Two of the reported changes are about visibility. An alarm is how an operator learns that a tank level or a pressure has moved out of band, and remote access is how a small utility looks at the plant without sending someone to it. With both off, a change to the pumping cycle runs unseen ^[6].

The state stopped short of attributing the intrusions ^[8]. Its spokesperson raised the Iran-linked activity and then declined to connect it. "We cannot confirm what foreign actors may have been involved, but we are aware of ongoing efforts across the nation by an Iranian-backed group to access drinking water and wastewater systems, as per the Cybersecurity and Infrastructure Security Agency," the spokesperson told The Denver Post ^[1]. Whether the two Colorado systems belong to that campaign is unconfirmed ^[2].

The public list of July targets goes state by state and says nothing about system sizes ^[9]. Two private systems serving fewer than 200 people had their settings, alarms and pumping changed, and the changes were brief enough that water service and public safety were unaffected ^[3][4][7].

The July activity reached at least a dozen states ^[2]. Seven have confirmed targets: Minnesota, Michigan, Georgia, South Dakota, New Jersey, Wisconsin and Alabama ^[9]. Subtract those from twelve and at least five states with confirmed victims remain unnamed ^[13].